OrcaRouter Releases OrcaCyber Zero 1.5 Security Model

OrcaRouter has introduced OrcaCyber Zero 1.5, a post-trained model specialized for authorized vulnerability research, exploit development, and penetration testing. Arriving as the successor to OrcaCyber Zero 1.0 from September 17, 2026, the text-in, text-out system operates exclusively via a hosted API. It features a 1M-token context window, a 128K maximum output limit, native tool calling, and structured outputs designed for autonomous security agents analyzing large codebases.

In vendor-reported evaluations from October 10, 2026, OrcaCyber Zero 1.5 achieved 100 percent on Cybench, solving 39 out of 39 tasks under unrestricted agent execution. It also reached 95.8 percent on CVE-Bench across a 24-task evaluable subset of web flaws, while registering its lowest published benchmark on SWE-bench Pro V2 at 76.5 percent. In comparison, Zero 1.0 held a 98.07 percent score on CyberGym inside Orca's harness, outperforming competitor benchmarks such as Anthropic's Claude Mythos Preview at 83.1 percent, OpenAI's GPT-5.5-Cyber at 85.6 percent, and Sakana AI's Fugu-Cyber at 86.9 percent.

For security practitioners, the model is available via an OpenAI-compatible API endpoint under a gated Security Research tier requiring an engagement, passkey, and accepted terms. OrcaRouter prices the service at $3.00 per 1M input tokens and $7.50 per 1M output tokens, with cache reads costing $0.75 per 1M tokens. This rates significantly lower than Claude Mythos Preview's $25 input and $125 output fees. Recent system metrics over a 1.3K token sample showed a median time-to-first-token of 500 ms and a p95 latency of 2.36 s, compared to Zero 1.0's 3.43 s p50 baseline.